MetaFlows

MetaFlows is a network security monitoring platform that deploys sensors to capture and analyze network traffic and security events. It provides both real-time and historical visibility into network activity. Key capabilities include: **Dashboard & Monitoring:** A central dashboard provides an overview of security events from the last 24 hours along with real-time sensor status. Users can also connect directly to individual sensors to receive a live stream of all events as they occur. **Historical Forensics:** All security events are retained for a minimum of one year and are accessible through a forensic query interface that automatically aggregates similar events over time to produce summary information. **Packet Capture & File Carving:** Sensors can log all network packets. The PCAP extraction and file carving interface allows users to query and analyze network flows historically, render downloaded or uploaded content, and extract PCAP files for offline analysis. **Reporting:** Customizable report templates generate recurring (daily or weekly) or one-time reports covering specific event types over user-defined time periods. **Asset Discovery:** Sensors passively and continuously collect information on internal network assets, providing visibility into what devices and services are running on the network. **IDS Rules Management:** The platform manages approximately 20,000 IDS rules that are updated daily, with an advanced configuration interface for customizing rule usage per sensor. **User-defined Classifications:** A classification editor allows users to define automated actions (highlight, block, email, ignore, or re-rank) when specific events occur, based on IP addresses, ports, message patterns (IDS, Syslog, file transfer, application, user login), and flow age or volume. **Multi-user Collaboration & Audit Logging:** The platform supports multiple users and maintains detailed audit logs of all user interactions, searchable through a dedicated interface.